A Dependabot secret literally named 'TOKEN' (or TOKEN_1, TOKEN_PROD) is a maintenance hazard - rotating it requires hunting through every workflow because the name conveys no scope or purpose. Brand-specific names (NPM_REGISTRY_TOKEN, GITHUB_PAT_PRIVATE_PKGS, AZURE_DEVOPS_PAT) make rotation surgical. Generic token names also strongly suggest credential reuse across registries, which amplifies blast radius on compromise.
1. Go to Repository or Organization Settings -> Secrets and variables -> Dependabot. 2. Rename TOKEN / TOKEN_* secrets to reflect the specific registry or service they unlock. 3. Update Dependabot config (dependabot.yml) registries entries that reference the renamed secret.
{
"target": "GHDependabotSecret",
"if": {
"allOf": [
{
"resource": "GHDependabotSecret",
"property": "Name",
"operator": "notMatch",
"value": "^TOKEN(_.*)?$"
}
]
},
"then": {
"effect": "Audit"
}
}Copyright © DevOps Shield. Tous droits réservés. Politique de confidentialité | Politique de témoins | Conditions d'utilisation | v1.0.2